Everest Forms Pro <= 1.9.12 - Unauthenticated RCE via Calculation Formula Injection

The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and including, 1.9.12. This is due to the Calculation Addon's processfilter function concatenating user-submitted form field values into a PHP code string without proper...

CVE-2026-59931

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...

CVE-2026-51259

The CVE-2026-51259 entry has concrete details in connected sources: the vulnerability is an unchecked unsigned integer overflow in buffer size calculation within the schreibfaul1 ESP32-audioI2S 3.4.5 product. This overflow causes an undersized PSRAM buffer allocation, which in turn leads to heap ...

TSIG packet with name compression can crash DNS

== Summary: Incorrect size calculations when a TSIG record contains compressed names can lead to a large out-of-bounds write causing the server to crash. Description To calculate the size of a DNS packet region signed by a TSIG record, Samba's internal DNS server subtracted the presumed size of t...

CVE-2026-51259

DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-31416)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505684; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

Siemens SIMATIC S7-1500 CPU 1518 MFP Incorrect Calculation of Buffer Size (CVE-2026-31515)

This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid505565; scriptversion"1.3"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2026-64357 xfs: fix exchmaps reservation limit check

In the Linux kernel, the following vulnerability has been resolved: xfs: fix exchmaps reservation limit check xfsexchmapsestimateoverhead adds the bmbt and rmapbt overhead to a local resblks variable, but the final UINTMAX check still tests req-resblks. That is the reservation value from before t...

CVE-2026-64272

The CVE-2026-64272 issue applies to the Linux kernel, affecting MMS114-driven touch controllers MMS134S and MMS136. The event size is 6 bytes, but the driver reads into a buffer using an 8-byte per-entry assumption (sizeof(struct mms114_touch)), causing subsequent events to be read from incorrect...

EUVD-2026-48585

Incorrect Calculation of Buffer Size vulnerability in Apache NimBLE when processing Legacy Advertising Report HCI event. When a single HCI advertising report event bundles multiple reports, NimBLE miscalculated the offset to the next report. This can cause the host to read past the end of the...

PT-2026-64421

Name of the Vulnerable Software and Affected Versions GPU DDK affected versions not specified Description An integer overflow occurs during the calculation of physical offsets for sparse PMRs Partial Memory Regions within the PMRLogicalOffsetToPhysicalOffset function. For PMRs larger than 4 GB,...

CVE-2026-29007

A flaw was found in U-Boot. A remote attacker can exploit an out-of-bounds read vulnerability in the tcprxstatemachine function when the Transmission Control Protocol TCP is enabled. By crafting a malicious packet with a mismatched IP total length and TCP data offset, an attacker can read beyond...

PYSEC-2026-3496 Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Summary src/libImaging/Jpeg2KDecode.c:853 accumulates totalcomponentwidth across every tile in a JPEG2000 image instead of recomputing it per tile. That accumulated value is then used in the tilebytes calculation at src/libImaging/Jpeg2KDecode.c:868, which can make the decoder grow state-buffer v...

CVE-2026-64009

A flaw was found in the Linux kernel's xfrm IPSec framework component. A local, unprivileged user can trigger an integer underflow in the Encapsulating Security Payload ESP module's Maximum Transmission Unit MTU calculation. This underflow leads to a severe out-of-bounds write, which can cause...

The vulnerability of the webService() method in the Calculation/Web/Service.php PHP library allows a attacker to perform an SSRF attack.

The vulnerability of the webService method in the Calculation/Web/Service.php PHP library of the PhpSpreadsheet framework is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to perform an SSRF attack remotely...

CVE-2026-65052 Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect o...

CVE-2026-65052 Ninja Forms Calculation and Payment Total Tampering via Fail-Open get_calc_value in ListSelect and ListRadio Fields

Ninja Forms WordPress plugin version 3.14.8 and prior contains an improper input validation vulnerability that allows unauthenticated attackers to inject arbitrary numeric values into form calculations and payment totals by submitting values that do not match any configured option in ListSelect o...

SUSE CVE-2026-63939

In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Compute the correct max length of the in-GHCB scratch area When setting the length of the GHCB scratch area, and the area is in the GHCB shared buffer, set the effective length of the scratch area to the max possible si...

CVE-2026-33328

libvips is a fast image processing library with low memory needs. On 32-bit systems in versions before and including 8.18.0, the gifload operation could incorrectly determine dimensions leading to an integer overflow. This has been patched in version 8.18.1...